beautypg.com

Configuring ports for ip source guard – LevelOne GTL-2691 User Manual

Page 392

background image

C

HAPTER

13

| Security Measures

IP Source Guard

– 392 –

C

ONFIGURING

P

ORTS

FOR

IP S

OURCE

G

UARD

Use the Security > IP Source Guard > Port Configuration page to set the

filtering type based on source IP address, or source IP address and MAC

address pairs.

IP Source Guard is used to filter traffic on an insecure port which receives

messages from outside the network or fire wall, and therefore may be

subject to traffic attacks caused by a host trying to use the IP address of a

neighbor.

CLI R

EFERENCES

"ip source-guard" on page 957

C

OMMAND

U

SAGE

Setting source guard mode to SIP (Source IP) or SIP-MAC (Source IP

and MAC) enables this function on the selected port. Use the SIP option

to check the VLAN ID, source IP address, and port number against all

entries in the binding table. Use the SIP-MAC option to check these

same parameters, plus the source MAC address. If no matching entry is

found, the packet is dropped.

N

OTE

:

Multicast addresses cannot be used by IP Source Guard.

When enabled, traffic is filtered based upon dynamic entries learned via

DHCP snooping (see

"DHCP Snooping" on page 396

), or static

addresses configured in the source guard binding table.

If IP source guard is enabled, an inbound packet’s IP address (SIP

option) or both its IP address and corresponding MAC address (SIP-

MAC option) will be checked against the binding table. If no matching

entry is found, the packet will be dropped.

Filtering rules are implemented as follows:

If DHCP snooping is disabled (see

page 399

), IP source guard will

check the VLAN ID, source IP address, port number, and source

MAC address (for the SIP-MAC option). If a matching entry is found

in the binding table and the entry type is static IP source guard

binding, the packet will be forwarded.

If DHCP snooping is enabled, IP source guard will check the VLAN

ID, source IP address, port number, and source MAC address (for

the SIP-MAC option). If a matching entry is found in the binding

table and the entry type is static IP source guard binding, or

dynamic DHCP snooping binding, the packet will be forwarded.

If IP source guard if enabled on an interface for which IP source

bindings have not yet been configured (neither by static

configuration in the IP source guard binding table nor dynamically

learned from DHCP snooping), the switch will drop all IP traffic on

that port, except for DHCP packets.